Whistleblowing policy

1. Purpose

This Policy applies to VaeroLabs AD ("VaeroLabs") and establishes the procedure for receiving, investigating and handling reports of breaches submitted through the Company's internal reporting channel

The Policy is adopted in accordance with:

• The Bulgarian Law on Protection of Persons Reporting or Publicly Disclosing Information on Breaches;
• Directive (EU) 2019/1937; and
• Ordinance No. 1 of 27.07.2023 regarding the register and handling of reports.

2. Scope

This Policy applies to reports concerning breaches of Bulgarian or EU law, including but not limited to:

• Human rights violations (child labour, forced labor or modern slavery, unequal opportunities, disregard of occupational health and safety obligations, violations of freedom of association, withholding of an adequate wage, etc.)
• Violations of environmental obligations (especially in the area of hazardous waste, mercury or persistent organic pollutants)
• Criminal offenses (for example corruption, fraud, embezzlement)
• Money laundering
• Infringements of competition, anti-trust and state aid laws
• Insider trading or market manipulation
• Conflicts of interest
• Embargo or export control breaches
• Data protection violations

3. Who May Report

Reports may be submitted by any person protected under the Law, including:

• employees;
• former employees;
• job applicants;
• contractors and consultants;
• trainees and volunteers;
• shareholders;
• members of management or supervisory bodies; and
• any other persons covered by applicable legislation.

4. Internal Reporting Channel

Reports may be submitted:

• by email to compliance@vaerolabs.com; or
• during a confidential meeting with the Responsible Person upon request.

Where a report concerns a member of the responsible team, it should be submitted to another responsible team member.

The internal reporting channel is administered by the Responsible Person or Responsible Team appointed by the Company.

5. Handling of Reports

After receiving a report, the Responsible Person shall:

• acknowledge receipt within 7 days;
• register the report and assign a Unique Identification Number (UIN);
• protect the reporting person's identity;
• assess and investigate the reported breach;
• take appropriate follow-up actions;
• provide feedback, where possible, within 90 days; and
• inform the reporting person about available external reporting channels where required.

6. Requirements for a Report

Reports may be submitted in writing or orally.

A report should contain, where available:

• the reporting person's contact details;
• description of the alleged breach;
• persons involved;
• date and place of the events;
• supporting evidence, if available.

Where essential information is missing, the reporting person may be requested to provide additional information within 7 days.

7. Protection of Reporting Persons

Reporting persons are protected where they:

• had reasonable grounds to believe the reported information was true at the time of reporting; and
• submitted the report through the applicable reporting channels or made a lawful public disclosure.

Protected persons shall not incur liability solely for making a report in accordance with the Law.

The protection also extends to persons connected with the reporting person where provided by applicable legislation.

8. Record Keeping

All reports shall be registered and securely maintained.

Where oral reports are submitted, they may be documented through:

• an audio recording (with the reporting person's consent); or
• a written transcript.

The reporting person may review and approve any transcript.

Reports and related documentation shall generally be retained for five years, unless a longer retention period is required due to legal proceedings.

9. Responsible Person

The Company appoints a Responsible Person (or Responsible Team) to administer the internal reporting channel.

The Responsible Person may perform additional duties provided this does not create a conflict of interest.

10. Cooperation with the Personal Data Protection Commission

The Responsible Person shall comply with all reporting obligations under applicable legislation, including:

• annual reporting to the Personal Data Protection Commission; and
• forwarding reports to the Commission where required by law.

The reporting person shall be informed where a report is forwarded.

11. Confidentiality

The identity of the reporting person, the reported person and all information contained in a report shall be treated as strictly confidential.

Disclosure is permitted only where required by applicable law or necessary for official investigations or court proceedings.

Where legally possible, the reporting person will be informed before their identity is disclosed.

12. Group Reporting Channels

As part of the Lufthansa Technik Group and Deutsche Lufthansa, employees may also report certain concerns through the Group's reporting channels anonymously through:

• the external Ombudsperson: Dr. Rajner Buchert from the external law firm Buchert Jacob Partner Rechtsanwälte Partnergesellschaft mbH, accessible via the contact form on the following web address: https://report.ombudsperson-frankfurt.de/en?c=lufthansa, via personal e-mail sent to: kanzlei@dr-buchert.de or mobile call to +49 69 710 33 33 0 or free call (from many countries) to +800 575 768 68;
• the BKMS electronic whistleblowing system (https://www.bkms-system.com/bkwebanon/report/clientInfo?cin=w62RT7&c=-1&language=eng)

Reports submitted through those channels are governed by their respective internal procedures rather than this Policy or Bulgarian law.

The Company may provide anonymised statistical information regarding reports to authorised Group entities where required.

Approved on: 05.06.2025

Last updated: 14.07.2025